xemu-project/xemu
1
0
Fork 0
mirror of https://github.com/xemu-project/xemu.git synced 2024-11-24 03:59:52 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

scripts/kvm/kvm_stat: Fix rlimit for unprivileged users

Browse Source 
Setting the hard limit as a unprivileged user either returns an error
when it is higher than the current one or irreversibly sets it lower.

Therefore we leave the hardlimit untouched as long as we don't need to
raise it as this needs CAP_SYS_RESOURCE.

This gives admins the possibility to run the script as an unprivileged
user to increase security.

Signed-off-by: Janosch Frank <frankja@linux.vnet.ibm.com>
Message-Id: <1452525484-32309-32-git-send-email-frankja@linux.vnet.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
Janosch Frank 2016-01-11 16:18:01 +01:00 committed by Paolo Bonzini
parent d8e44802f8
commit 1cd55f9dc7
1 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
scripts/kvm/kvm_stat
View File

@ -434,11 +434,19 @@ class TracepointProvider(object):
# The constant is needed as a buffer for python libs, std # The constant is needed as a buffer for python libs, std
# streams and other files that the script opens. # streams and other files that the script opens.
rlimit = len(cpus) * len(self._fields) + 50 newlim = len(cpus) * len(self._fields) + 50
try: try:
resource.setrlimit(resource.RLIMIT_NOFILE, (rlimit, rlimit)) softlim_, hardlim = resource.getrlimit(resource.RLIMIT_NOFILE)
if hardlim < newlim:
# Now we need CAP_SYS_RESOURCE, to increase the hard limit.
resource.setrlimit(resource.RLIMIT_NOFILE, (newlim, newlim))
else:
# Raising the soft limit is sufficient.
resource.setrlimit(resource.RLIMIT_NOFILE, (newlim, hardlim))
except ValueError: except ValueError:
sys.exit("NOFILE rlimit could not be raised to {0}".format(rlimit)) sys.exit("NOFILE rlimit could not be raised to {0}".format(newlim))
for cpu in cpus: for cpu in cpus:
group = Group() group = Group()